Repository navigation
ci(homebrew): trust the throw-away tap under test (Homebrew 7.0.11) - #3
Merged
Merged
Conversation
Homebrew 7.0.11 added brew trust: a formula of a tap that is not official is loaded only once it or its tap is trusted, and brew audit refuses the formula of the throw-away tap with "Refusing to load formula ... from untrusted tap". brew install trusts the formula it installs, but the audit runs before it. When this Homebrew has brew trust, the throw-away tap (and only it) is trusted right after brew tap-new, and the cleanup on exit, on success and on failure, untrusts it before untapping it; brew untrust --tap also forgets the formula brew install trusted. The checks themselves are unchanged. Older Homebrew without brew trust runs as before. Claude-Session: https://claude.ai/code/session_01RbGbwRHvCEhsKLZfbvbbRg
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Homebrew 7.0.11 introduced
brew trust. A formula of a tap that is not official is loaded only once the formula or its tap is trusted, sobrew audit --stricton the formula in the throw-away tap ofscripts/homebrew-e2e.sh(jobhomebrew-e2e) exits 1:The same failure hit magicdrive/t's Homebrew test (fixed in magicdrive/t#5). The last green runs here predate Homebrew 7.0.11 on the runners, so the next run is expected to fail the same way.
Cause
brew install <tap>/<formula>trusts the formula it installs, but the audit runs on the formula of a fresh, untrusted throw-away tap before that.brew styledoes not need trust.Fix
brew trust(brew trust --helpsucceeds), the throw-away tap, and only it, is trusted right afterbrew tap-new(brew trust --tap "$tap"). The production tap magicdrive/tap is never trusted.trap cleanup EXIT, on success and on failure, runsbrew untrust --tap "$tap"beforebrew untap;brew untrust --tapalso forgets the formulabrew installtrusted, so trust.json is left as it was.brew trustruns exactly as before.Verification
bash -n/sh -n, shellcheck (as CI runs it), actionlint, and the repository's related tests pass locally.homebrew/brew:latestafterbrew update(Homebrew 7.0.11):brew tap-new→brew auditfails as above while untrusted; afterbrew trust --tapaudit, info, install and test pass;brew untrust --tap+brew untapleavebrew trust --json=v1empty. The fixed scripts of enma, goreg, kjak and git-parallel passed end to end there, withbrew trust --json=v1empty and only homebrew/core tapped afterwards; a forced failure after the audit also left it empty (cleanup on failure). The unfixed enma script failed there with the error above.homebrew-e2ejobs on ubuntu-latest and macos-latest.https://claude.ai/code/session_01RbGbwRHvCEhsKLZfbvbbRg